> Right, but you have to be on the local network to do that But who is "you" here? Are you assuming the attacker needs to be physically present on your network

> Right, but you have to be on the local network to do that But who is "you" here? Are you assuming the attacker needs to be physically present on your network? can any malicious script running on browser's victim make an xhr request to "192.168.0.1/page-which-exposes-password"?